{"id":"00eee2a5-fdb0-4746-a21d-e43fbdea5681","title":"Linux Doas Conf File Creation","description":"Detects the creation of doas.conf file in linux host platform.","author":"Sittikorn S, Teoderick Contreras","status":"stable","level":"medium","date":"2022-01-20","modified":"2022-12-31","tags":["attack.privilege-escalation","attack.t1548"],"technique_ids":["T1548"],"logsource":{"product":"linux","category":"file_event"},"falsepositives":["Unlikely"],"references":["https://research.splunk.com/endpoint/linux_doas_conf_file_creation/","https://www.makeuseof.com/how-to-install-and-use-doas/"],"source_path":"rules/linux/file_event/file_event_lnx_doas_conf_creation.yml","source_sha256":"602ec92e16300af72cf92144116558d437c7a91b2ed2d647b936fe9207eabb1e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Doas Conf File Creation\nid: 00eee2a5-fdb0-4746-a21d-e43fbdea5681\nstatus: stable\ndescription: Detects the creation of doas.conf file in linux host platform.\nreferences:\n    - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/\n    - https://www.makeuseof.com/how-to-install-and-use-doas/\nauthor: Sittikorn S, Teoderick Contreras\ndate: 2022-01-20\nmodified: 2022-12-31\ntags:\n    - attack.privilege-escalation\n    - attack.t1548\nlogsource:\n    product: linux\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith: '/etc/doas.conf'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","page":"techniques/enterprise/T1548/"}],"data_path":"data/detection-rules/00eee2a5-fdb0-4746-a21d-e43fbdea5681.json","kind":"sigma"}